Documentation Grafana Enterprise Logs Send data Promtail Pipeline stages

Promtail pipeline stages

This section is a collection of all stages Promtail supports in a Pipeline.

Parsing stages:

• docker: Extract data by parsing the log line using the standard Docker format.
• cri: Extract data by parsing the log line using the standard CRI format.
• regex: Extract data using a regular expression.
• json: Extract data by parsing the log line as JSON.
• logfmt: Extract data by parsing the log line as logfmt.
• replace: Replace data using a regular expression.
• multiline: Merge multiple lines into a multiline block.
• geoip: Extract geoip data from extracted labels.

Transform stages:

• template: Use Go templates to modify extracted data.
• pack: Packs a log line in a JSON object allowing extracted values and labels to be placed inside the log line.
• decolorize: Strips ANSI color sequences from the log line.

Action stages:

• timestamp: Set the timestamp value for the log entry.
• output: Set the log line text.
• labeldrop: Drop label set for the log entry.
• labelallow: Allow label set for the log entry.
• labels: Update the label set for the log entry.
• limit: Limit the rate lines will be sent to Loki.
• sampling: Sampling the lines will be sent to Loki.
• static_labels: Add static-labels to the log entry.
• metrics: Calculate metrics based on extracted data.
• tenant: Set the tenant ID value to use for the log entry.
• structured_metadata: Add structured metadata to the log entry.

Filtering stages:

• match: Conditionally run stages based on the label set.
• drop: Conditionally drop log lines based on several options.